The mental health organization I am working with wants to install cameras in an area where people receive services (so they are identified by face and as being in need of the service provided). The organization will have an app to monitor camera activity etc but they want an existing telecommunications company to install and maintain the cameras and the video/images. The company they have chosen has never and will not use a BAA but insists they have a secure system. Is this sufficient? Does the provider of surveillance services need to be HIPAA compliant or just the organization accessing the data? The telecommunications provider would have access to the server storing the video/images.
Question No. 111